Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	Sensiva	Sensiva.exe	"Symbol Commander makes the use of your PC
X	SENTRY	SENTRY.exe	"From IP Insight. Allows website owners "to instantly determine the precise geographic location
X	Sepate Security Firewall	sepate.exe	"Added by a variant of the RBOT WORM!"
X	septpop06apsept	septpop06apsept.exe	"MediaMotor.Popupwithcast adware"
X	Serials	serials.exe	Any one of a variety of worms and trojans
X	SernellApp.pcx	csrss.exe	"Added by the BANCBAN-BJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""D5133"" subfolder"
X	serpe	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	serpe	msmbw.exe	"Added by the SERFLOG.A WORM!"
X	serpe	serbw.exe	"Added by the SERFLOG.A WORM!"
Y	serrdctl.exe	serrdctl.exe	"Shared Modem Service Client Event Viewer" - used when a number of PCs have access to a number of modems. Required to be running on each PC for access to the modems
X	SERV PacK2	nerx.exe	"Added by the SDBOT-ACP WORM!"
N	Serv-U	serv-u32.exe	FTP server
X	Serv-U	wssdsu.exe	"Added by the MANIFEST TROJAN!"
X	server	server.exe	"Added by the DELTAD.A WORM!"
X	server	system.exe	"Added by the METHS-A TROJAN!"
X	server	server.exe	"Added by the SINGU-Q TROJAN!"
X	Server Backbone	server05.exe	"Added by the RBOT-ZM WORM!"
X	SERVER.EXE	SERVER.EXE	"Added by the BUSHTRO122 or SMOKODOOR TROJANS!"
X	serverex	Server.txt.vbs	"Added by the DELTAD.A WORM!"
X	Service	service.exe	"Added by the ALADINZ.H TROJAN!"
X	Service	[trojan filename]	"Added by the KAITEX.E TROJAN!"
X	Service	services.exe	"Added by the NETSKY or NETSKY.B WORMS! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	Service	SYSNT.exe	"Added by the CHA TROJAN!"
X	Service	Service.pif	"Added by the ASSIRAL-C WORM!"
X	service	wN2S.exe	"Added by a variant of the RBOT WORM!"
X	Service Cleaner	filen.exe	"Added by the RBOT.BRH WORM!"
N	Service Connection	sccenter.exe	For Compaq PC's. Part of Backweb
N	Service Connection	bwtray.exe	For Compaq PC's. Part of Backweb
X	Service Controller	Csrrs.exe	"Added by the GAOBOT.AO WORM!"
X	Service Controller	service.exe	"Added by the PREVERT TROJAN!"
X	Service Drivers	msnpg.exe	"Added by the RBOT.BMD WORM!"
X	Service Drivers	PC.EXE	"Added by the SDBOT-WK WORM!"
X	Service Drivers	Compt.exe	"Added by the RBOT-ZJ WORM!"
X	Service Drivers	abl.exe	"Added by the SDBOT-YX WORM!"
X	Service Host	[filename].exe	"Added by the TORVEL.B WORM!"
X	Service Host	spoolxx.exe	"Added by the TORVEL WORM!"
X	Service Host	svchost.exe	"Added by the DAOSER-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Services{C922CCC4-CF61-4589-A0D1-828160704853} subfolder"
X	Service Host	svchost.exe	"Added by the DAOSER-C TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a Services[random] subfolder"
X	Service Host	svchost.exe	"Added by the TORVEL WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder"
X	Service Host Driver	svchost.exe	"Added by the HITON TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder"
X	Service Host Process	spoolsvc.exe	"Added by the GAOBOT.GEN!POLY WORM!"
N	Service Manager	sqlmangr.exe	"SQL Server Service Manager - provides tray access to SQL server
X	Service Manager	SERVICEMGR.EXE	"Added by the PASSMAIL-D VIRUS!"
X	Service Manager	dxsound.exe	"Added by the PROXY-GRIC TROJAN!"
X	service manager	service.exe	"Added by the DONBOMB.A TROJAN!"
X	Service Monitor	msnfilen.exe	"Added by the RBOT-ALE WORM!"
X	Service Monitor	javams32.exe	"Added by the DELF-NK TROJAN!"
X	Service Monitor	javams64.exe	"Added by the SDBOT-AFO WORM!"
X	Service Monitor	msnserve.exe	"Added by the SPYBOT.YQW WORM!"
X	Service Monitor	WinOcx.exe	"Added by the RBOT-AQJ WORM!"
X	Service Monitor	csnss.exe	"Added by the RBOT.EEH WORM!"
X	Service Monitor	filen.exe	"Added by a variant of the RBOT WORM!"
X	Service Pack	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe
X	Service Pack DLL Runtime	spdll32.exe	"Added by a variant of the RBOT WORM!"
X	Service Process	SVCHOST.EXE	"Added by the DARKER WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder"
X	Service Process	winset.exe	"Added by a variant of the SPYBOT WORM!"
X	Service Process	service.exe	"Added by the DCMBOT-C TROJAN!"
X	Service Process	smss.exe	"Added by the DCMBOT-E TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""config"" subfolder"
X	Service Process	smss.exe	"Added by the DCMBOT-E TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in ""config"" subfolder"
X	Service Process	svchost.exe	"Added by the DCMBOT-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""config"" subfolder"
X	Service Registry NT Save	jdbgmgrnt.exe	"Added by the BANCOS-CG TROJAN!"
X	Service Registry NT Save	taskmgrnt.exe	"Added by the BANCOS-BY TROJAN!"
X	Service Registry NT Save	regeditnt.exe	"Added by the BANCOS-BM TROJAN!"
X	Service Scheduler	scheduler.exe	"Added by the AGOBOT-PH WORM!"
X	Service System	kernels32.exe	"Added by the BANCOS-DA TROJAN!"
X	Service System	windowsXP.exe	"Added by the BANCOS-EL TROJAN!"
X	Service System	kgbfsm344.exe	"Added by the BANCOS-FS TROJAN!"
X	Service System	wernell87.exe	"Added by the BANCOS-FJ TROJAN!"
X	service updaer	qualityz.exe	"Added by an unidentified VIRUS
X	Service.exe	Service.exe	"""servedby.advertising"" popup generator"
X	service32	service32.exe	"Added by the AGOBOT-ST WORM!"
U	ServiceConfig	ispbeg.exe	"Comcast Transition Wizard. On June 30th
X	serviceconnect	serviceconnect.exe	"Added by the AGOBOT.AIR WORM!"
Y	ServiceLayer	ServiceLayer.exe	Nokia Connectivity Library support task that is needed by NCLTRAY and by the Nokia Connection Manager for either to work properly
X	servicemng	service.exe	"Added by the TAME-C WORM!"
X	services	start.bat	"Added by the ZCREW TROJAN!"
X	Services	[path to trojan]	"Added by the METEORSHELL TROJAN!"
X	Services	back32.exe ...service.exe	"Added by an unidentified VIRUS
X	Services	services.exe	"Added by a number of VIRUSES
X	Services	winread.exe	"Added by an unidentified VIRUS
X	Services	windns.exe	"Added by a variant of the RBOT WORM!"
X	Services	mshost.exe	"Added by the LANFILT-J TROJAN!"
X	services	Svchosts.exe	"Added by the SDBOT.N WORM!"
X	Services	csrss.exe	"Added by a variant of the RANKY.U TROJAN! Note - this is not the legitimate csrss.exe process
X	Services	scks32.exe	"Added by a Proxy Trojan variant"
X	Services	sockys32.exe	Added by the RANKY.L TROJAN!
X	Services	sys.exe	"Added by a Proxy Trojan variant"
X	services	windows32.exe	"Added by the FLYVB-C WORM!"
X	services	socks.exe	Added by the WIN32.SMALL.N TROJAN!
X	Services	services.exe	"Added by the ZINCITE.A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	Services	[path to trojan]	"Added by the RANCK-DB TROJAN!"
X	Services	iexplore.exe	"Added by the MOGI WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	Services	svchost.exe	"Added by the REPER-B WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Services Administrator	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Controller	lsassa.exe	Added by the CIADOOR.122 VIRUS!
X	Services Controller	services.exe	"Added by the CIADOOR-F TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	Services Host	Scchost.exe	"Added by the DONK WORM!"
X	Services Host	svchost32.exe	"Added by the AGOBOT-TG WORM!"
X	Services Logon	services.exe	"Added by the CROWT.A WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! By default this file is located in Documents and Settings[user name]Templates"
X	Services Process	services.exe	"Spyware - recognized by Kaspersky antivirus as Small.X TROJAN! Note - this is not the legitimate services.exe process
X	Services Process	smss.exe	"Added by the SMALL-EK TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""config"" subfolder"
X	Services Startup	services.exe	"Added by the CROWT.A WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! By default this file is located in Documents and Settings[user name]Templates"
X	Services Startup	svhost33.exe	"Added by a variant of the RBOT WORM!"
X	Services.dll	smss.exe	"Added by the SOBER-L WORM! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a msagentsystem subfolder of the Winnt or Windows folder"
X	Services.EXE	services.exe	"Added by the KAZPING WORM! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	services.exe	Services.exe	"Added by the CIADOOR-F TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	Services004	[worm filename]	"Added by the BUGBROS WORM!"
X	services32	mc-110-12-0000079.exe	Added by the TrojanDownloader.Agent.rv TROJAN!
X	services32	mc-58-12-0000120.exe	"""Shorty"" adware - also detected as the AGENT.FD TROJAN!"
X	services32	mc-58-12-0000140.exe	"""Shorty"" adware - also detected as the AGENT.FD TROJAN!"
X	Services32 Startup	win32dll.exe	"Added by the SDBOT-XO WORM!"
X	ServicesLoad	lsass.exe	"Added by the DEARIS-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	ServicesLog	ccapp32.exe	"Added by the RBOT-AMX WORM!"
X	Servicing	hostd.exe	"Added by the SDBOT.BUI WORM!"
X	Servicio Local	svhost.exe	"Added by a variant of the RBOT WORM!"
X	servics	servics.exe	"Added by the SINGU-J TROJAN!"
X	SERVlCE	SERVlCE.EXE	"Added by the AGOBOT-UB WORM!"
?	ServUTrayIcon	ServUTray.exe	"System Tray icon for Serv-U FTP server. Is it required?"
U	Session Client	sescli.exe	"SurfSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Session Manager Subsystem	smssa.exe	"Added by the RBOT-AGS WORM!"
X	SESync	sed.exe	"DownloadWare adware"
?	SetDefaultMIDI	MIDIDef.exe	"Related to a Soundblaster Audigy soundcards. What does it do and is it required?"
N	setdefprt	setdefprt.exe	Used to set a Brother MFC printer/copier/scanner as the default printer after installation
N	SetDefPrt	BrStDvPt.exe	Used to set a Brother MFC printer/copier/scanner as the default printer after installation
U	SetecCertUtil	Certutil.exe	"Setec Web and Email Security. Setec PKI smart card software. The PKI technology enables secure and reliable user identification in services offered through Internet
X	setFTPBack	createsw.exe	"Added by the FTP_BMAIL TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.